m3sb[.]exe | Triage™

General

Target
m3sb.exe
Size 290KB
Sample260608-w6ka1sdy21
SHA256 debc5c39c63e7bf069315525a72e749f6617d70af8c2ce09a4d88bfd7b10bfda
MD5 de8903a1e58d570b3fd05632523bdeb1
SHA1 6be6c210a4b121adede9add3f226e1c90c687126
SHA512 ab7c29080eb3f7358379314bbfa40b9b4e2e58969695ffab8270cd0f0e0edab911711a189a6683ac780e9242d2d53d4c494457ce5cd5afa6e3e20dc56700a87e
SSDEEP 6144:fV9wAjWtlE1npxArpq/neKYFaAIlJ+XniCOB:4e1nsrpqPdYgRCOB
TLSH
T13654CF46B7AA10FED277C574C9864905EF7278564B90AADF13A00BF28F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
m3sb.exe

File Explorer

m3sb.exe

.exe 290KB

m3sb.exe

IMPHASH d5c3e26de9266f7be59fedd2f28eb82a
SHA256 debc5c39c63e7bf069315525a72e749f6617d70af8c2ce09a4d88bfd7b10bfda
MD5 de8903a1e58d570b3fd05632523bdeb1
SHA1 6be6c210a4b121adede9add3f226e1c90c687126
SHA512 ab7c29080eb3f7358379314bbfa40b9b4e2e58969695ffab8270cd0f0e0edab911711a189a6683ac780e9242d2d53d4c494457ce5cd5afa6e3e20dc56700a87e
SSDEEP 6144:fV9wAjWtlE1npxArpq/neKYFaAIlJ+XniCOB:4e1nsrpqPdYgRCOB
TLSH
T13654CF46B7AA10FED277C574C9864905EF7278564B90AADF13A00BF28F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

32776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SystemParametersInfoW wsprintfW

shell32

ShellExecuteExW

advapi32

AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW OpenProcessToken AdjustTokenPrivileges CheckTokenMembership FreeSid

kernel32

HeapReAlloc WriteConsoleW HeapSize CreateFileW GetDriveTypeW GetFileSizeEx GetLogicalDriveStringsW ReadFile WriteFile GetTempPathW CloseHandle Sleep GetCurrentProcess GetCurrentProcessId ExitProcess GetCurrentProcessorNumber GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW MoveFileExW LocalFree FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetConsoleMode RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCPInfo GetStdHandle HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetStringTypeW GetFileType SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP

Name

.text

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

m3sb.exe

user32

shell32

advapi32

kernel32

generic